abc17ff702811fd92f9ac2436de00d4b407356f958ee7d3daa195fcd21b4d1aa

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0328be996849741e83cd3ba594392e90N.exe
Size

468KB
MD5

0328be996849741e83cd3ba594392e90
SHA1

62d26294cb47284174c45820f500f7d017082a09
SHA256

abc17ff702811fd92f9ac2436de00d4b407356f958ee7d3daa195fcd21b4d1aa
SHA512

105655dded854152734023944fdcfa17ece500ccd4761359da665c7fdba268e737e6b383b60a69a22dfb6dfba4a9fdd7a0be7dc12817074c90dd245e91105783
SSDEEP

3072:ObYZog5OP08UAaYtPzijff8/EChA/4pRBdHeZVaFdwW3WImg/haH:Obeox5UA1PejffZEUmdw8vmg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1208	Unicorn-32863.exe
2128	Unicorn-49879.exe
1276	Unicorn-62686.exe
680	Unicorn-50751.exe
3452	Unicorn-13676.exe
1728	Unicorn-19807.exe
4440	Unicorn-65478.exe
4112	Unicorn-28751.exe
2980	Unicorn-25605.exe
5076	Unicorn-38180.exe
1840	Unicorn-52030.exe
1760	Unicorn-52295.exe
1816	Unicorn-62501.exe
3432	Unicorn-3094.exe
2712	Unicorn-16970.exe
4816	Unicorn-48927.exe
4476	Unicorn-16063.exe
880	Unicorn-51349.exe
528	Unicorn-42020.exe
1160	Unicorn-22154.exe
460	Unicorn-12917.exe
396	Unicorn-63639.exe
4508	Unicorn-31844.exe
2132	Unicorn-52134.exe
544	Unicorn-63069.exe
4408	Unicorn-6462.exe
4492	Unicorn-14365.exe
1796	Unicorn-8500.exe
4424	Unicorn-6462.exe
2996	Unicorn-49607.exe
4260	Unicorn-14282.exe
1196	Unicorn-49799.exe
3596	Unicorn-46270.exe
1304	Unicorn-4940.exe
384	Unicorn-56742.exe
1068	Unicorn-11070.exe
4104	Unicorn-50951.exe
1188	Unicorn-26255.exe
4836	Unicorn-1677.exe
1896	Unicorn-26639.exe
4896	Unicorn-57111.exe
4296	Unicorn-18116.exe
4204	Unicorn-4381.exe
552	Unicorn-34836.exe
4956	Unicorn-40967.exe
1788	Unicorn-61942.exe
524	Unicorn-57495.exe
3636	Unicorn-41351.exe
5004	Unicorn-45990.exe
4068	Unicorn-22908.exe
2288	Unicorn-31839.exe
3188	Unicorn-48175.exe
2344	Unicorn-18417.exe
4016	Unicorn-24548.exe
3220	Unicorn-39934.exe
1268	Unicorn-28501.exe
4808	Unicorn-64811.exe
3516	Unicorn-26660.exe
4300	Unicorn-48486.exe
3180	Unicorn-27319.exe
2872	Unicorn-40509.exe
4544	Unicorn-44231.exe
5052	Unicorn-52399.exe
3576	Unicorn-46269.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2744	552	WerFault.exe	138
12420	8900	WerFault.exe	386
15352	12488	WerFault.exe	690
19088	9264	WerFault.exe	423
19112	10632	WerFault.exe	498

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0328be996849741e83cd3ba594392e90N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22641.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15672	dwm.exe
Token: SeChangeNotifyPrivilege	15672	dwm.exe
Token: 33	15672	dwm.exe
Token: SeIncBasePriorityPrivilege	15672	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3836	0328be996849741e83cd3ba594392e90N.exe
1208	Unicorn-32863.exe
2128	Unicorn-49879.exe
1276	Unicorn-62686.exe
680	Unicorn-50751.exe
3452	Unicorn-13676.exe
4440	Unicorn-65478.exe
1728	Unicorn-19807.exe
4112	Unicorn-28751.exe
2980	Unicorn-25605.exe
5076	Unicorn-38180.exe
2712	Unicorn-16970.exe
3432	Unicorn-3094.exe
1816	Unicorn-62501.exe
1840	Unicorn-52030.exe
1760	Unicorn-52295.exe
4816	Unicorn-48927.exe
4476	Unicorn-16063.exe
880	Unicorn-51349.exe
1160	Unicorn-22154.exe
460	Unicorn-12917.exe
528	Unicorn-42020.exe
4508	Unicorn-31844.exe
396	Unicorn-63639.exe
4424	Unicorn-6462.exe
4408	Unicorn-6462.exe
4492	Unicorn-14365.exe
544	Unicorn-63069.exe
2132	Unicorn-52134.exe
1796	Unicorn-8500.exe
2996	Unicorn-49607.exe
1196	Unicorn-49799.exe
4260	Unicorn-14282.exe
3596	Unicorn-46270.exe
384	Unicorn-56742.exe
1304	Unicorn-4940.exe
1068	Unicorn-11070.exe
4104	Unicorn-50951.exe
1188	Unicorn-26255.exe
4836	Unicorn-1677.exe
4896	Unicorn-57111.exe
1896	Unicorn-26639.exe
4296	Unicorn-18116.exe
4956	Unicorn-40967.exe
4204	Unicorn-4381.exe
1788	Unicorn-61942.exe
524	Unicorn-57495.exe
552	Unicorn-34836.exe
2288	Unicorn-31839.exe
5004	Unicorn-45990.exe
3188	Unicorn-48175.exe
4068	Unicorn-22908.exe
3636	Unicorn-41351.exe
4016	Unicorn-24548.exe
1268	Unicorn-28501.exe
2344	Unicorn-18417.exe
3220	Unicorn-39934.exe
4808	Unicorn-64811.exe
3516	Unicorn-26660.exe
4300	Unicorn-48486.exe
3180	Unicorn-27319.exe
2872	Unicorn-40509.exe
2104	Unicorn-22641.exe
5052	Unicorn-52399.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1208	3836	0328be996849741e83cd3ba594392e90N.exe	88
PID 3836 wrote to memory of 1208	3836	0328be996849741e83cd3ba594392e90N.exe	88
PID 3836 wrote to memory of 1208	3836	0328be996849741e83cd3ba594392e90N.exe	88
PID 1208 wrote to memory of 2128	1208	Unicorn-32863.exe	93
PID 1208 wrote to memory of 2128	1208	Unicorn-32863.exe	93
PID 1208 wrote to memory of 2128	1208	Unicorn-32863.exe	93
PID 3836 wrote to memory of 1276	3836	0328be996849741e83cd3ba594392e90N.exe	94
PID 3836 wrote to memory of 1276	3836	0328be996849741e83cd3ba594392e90N.exe	94
PID 3836 wrote to memory of 1276	3836	0328be996849741e83cd3ba594392e90N.exe	94
PID 2128 wrote to memory of 680	2128	Unicorn-49879.exe	96
PID 2128 wrote to memory of 680	2128	Unicorn-49879.exe	96
PID 2128 wrote to memory of 680	2128	Unicorn-49879.exe	96
PID 3836 wrote to memory of 3452	3836	0328be996849741e83cd3ba594392e90N.exe	97
PID 3836 wrote to memory of 3452	3836	0328be996849741e83cd3ba594392e90N.exe	97
PID 3836 wrote to memory of 3452	3836	0328be996849741e83cd3ba594392e90N.exe	97
PID 1276 wrote to memory of 1728	1276	Unicorn-62686.exe	99
PID 1276 wrote to memory of 1728	1276	Unicorn-62686.exe	99
PID 1276 wrote to memory of 1728	1276	Unicorn-62686.exe	99
PID 1208 wrote to memory of 4440	1208	Unicorn-32863.exe	98
PID 1208 wrote to memory of 4440	1208	Unicorn-32863.exe	98
PID 1208 wrote to memory of 4440	1208	Unicorn-32863.exe	98
PID 680 wrote to memory of 4112	680	Unicorn-50751.exe	102
PID 680 wrote to memory of 4112	680	Unicorn-50751.exe	102
PID 680 wrote to memory of 4112	680	Unicorn-50751.exe	102
PID 2128 wrote to memory of 2980	2128	Unicorn-49879.exe	103
PID 2128 wrote to memory of 2980	2128	Unicorn-49879.exe	103
PID 2128 wrote to memory of 2980	2128	Unicorn-49879.exe	103
PID 3452 wrote to memory of 5076	3452	Unicorn-13676.exe	104
PID 3452 wrote to memory of 5076	3452	Unicorn-13676.exe	104
PID 3452 wrote to memory of 5076	3452	Unicorn-13676.exe	104
PID 3836 wrote to memory of 1840	3836	0328be996849741e83cd3ba594392e90N.exe	105
PID 3836 wrote to memory of 1840	3836	0328be996849741e83cd3ba594392e90N.exe	105
PID 3836 wrote to memory of 1840	3836	0328be996849741e83cd3ba594392e90N.exe	105
PID 4440 wrote to memory of 1760	4440	Unicorn-65478.exe	106
PID 4440 wrote to memory of 1760	4440	Unicorn-65478.exe	106
PID 4440 wrote to memory of 1760	4440	Unicorn-65478.exe	106
PID 1208 wrote to memory of 1816	1208	Unicorn-32863.exe	107
PID 1208 wrote to memory of 1816	1208	Unicorn-32863.exe	107
PID 1208 wrote to memory of 1816	1208	Unicorn-32863.exe	107
PID 1728 wrote to memory of 3432	1728	Unicorn-19807.exe	108
PID 1728 wrote to memory of 3432	1728	Unicorn-19807.exe	108
PID 1728 wrote to memory of 3432	1728	Unicorn-19807.exe	108
PID 1276 wrote to memory of 2712	1276	Unicorn-62686.exe	109
PID 1276 wrote to memory of 2712	1276	Unicorn-62686.exe	109
PID 1276 wrote to memory of 2712	1276	Unicorn-62686.exe	109
PID 4112 wrote to memory of 4816	4112	Unicorn-28751.exe	110
PID 4112 wrote to memory of 4816	4112	Unicorn-28751.exe	110
PID 4112 wrote to memory of 4816	4112	Unicorn-28751.exe	110
PID 2980 wrote to memory of 4476	2980	Unicorn-25605.exe	111
PID 2980 wrote to memory of 4476	2980	Unicorn-25605.exe	111
PID 2980 wrote to memory of 4476	2980	Unicorn-25605.exe	111
PID 2128 wrote to memory of 880	2128	Unicorn-49879.exe	112
PID 2128 wrote to memory of 880	2128	Unicorn-49879.exe	112
PID 2128 wrote to memory of 880	2128	Unicorn-49879.exe	112
PID 5076 wrote to memory of 528	5076	Unicorn-38180.exe	113
PID 5076 wrote to memory of 528	5076	Unicorn-38180.exe	113
PID 5076 wrote to memory of 528	5076	Unicorn-38180.exe	113
PID 3452 wrote to memory of 1160	3452	Unicorn-13676.exe	114
PID 3452 wrote to memory of 1160	3452	Unicorn-13676.exe	114
PID 3452 wrote to memory of 1160	3452	Unicorn-13676.exe	114
PID 680 wrote to memory of 460	680	Unicorn-50751.exe	115
PID 680 wrote to memory of 460	680	Unicorn-50751.exe	115
PID 680 wrote to memory of 460	680	Unicorn-50751.exe	115
PID 1760 wrote to memory of 396	1760	Unicorn-52295.exe	116

C:\Users\Admin\AppData\Local\Temp\0328be996849741e83cd3ba594392e90N.exe
"C:\Users\Admin\AppData\Local\Temp\0328be996849741e83cd3ba594392e90N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exe
        9⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        10⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        11⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        11⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        10⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        9⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        9⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        9⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        10⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        10⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        9⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        9⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        8⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8900 -s 488
        9⤵
        Program crash
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        9⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        10⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        9⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        9⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        9⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
        9⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        9⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        9⤵
        
        PID:17984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        8⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        8⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        7⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14282.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
        10⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        10⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        9⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        9⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        9⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        8⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        9⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        9⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        8⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        7⤵
        
        PID:18556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        9⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        9⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        9⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        8⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        7⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        6⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50951.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        9⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        10⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        9⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31122.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        8⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        6⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        9⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        9⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        9⤵
        
        PID:18524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        7⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
        7⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41501.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        7⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        6⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        9⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        10⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        10⤵
        
        PID:18796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        9⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        9⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        10⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        9⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        8⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
        9⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        9⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7801.exe
        7⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        9⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        7⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58510.exe
        6⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12488 -s 432
        7⤵
        Program crash
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        6⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        9⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        9⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        8⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18634.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        7⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46269.exe
        5⤵
        Executes dropped EXE
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        6⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        9⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        8⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        7⤵
        
        PID:19216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        5⤵
        
        PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        9⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        9⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        8⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        8⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        8⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        6⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        7⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        8⤵
        
        PID:19208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        7⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30276.exe
        6⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        7⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        7⤵
        
        PID:19448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32860.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        7⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        5⤵
        
        PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        7⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28843.exe
        6⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        5⤵
        
        PID:18036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
      4⤵
      PID:13064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25795.exe
      4⤵
      PID:16456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        9⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        8⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        7⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        8⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        8⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
        7⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        7⤵
        
        PID:18500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
        5⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        7⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        7⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        6⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        6⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39003.exe
        5⤵
        
        PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        7⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
      4⤵
      PID:14672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        6⤵
        
        PID:18484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        5⤵
        
        PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32815.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        6⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        5⤵
        
        PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      4⤵
      PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        5⤵
        
        PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
      4⤵
      PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
      4⤵
      PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10339.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        7⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45157.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        6⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        5⤵
        
        PID:18508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        5⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
      4⤵
      PID:17280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        5⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42941.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23031.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      4⤵
      PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
    3⤵
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        5⤵
        
        PID:18804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28052.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
      4⤵
      PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
    3⤵
    PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
      4⤵
      PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
    3⤵
    PID:11676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31379.exe
    3⤵
    PID:16812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        9⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56493.exe
        9⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        8⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe
        7⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        8⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10949.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        7⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        7⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe
        6⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        6⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        8⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        8⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        6⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        6⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10632 -s 488
        7⤵
        Program crash
        
        PID:19112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        6⤵
        
        PID:18532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        7⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        7⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50059.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40915.exe
        6⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        7⤵
        
        PID:18776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28837.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        5⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        7⤵
        
        PID:19020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        5⤵
        
        PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        7⤵
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
      4⤵
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        5⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46332.exe
        6⤵
        
        PID:18788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30565.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        7⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        7⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        5⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
        6⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        7⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11709.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
        6⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        5⤵
        
        PID:9264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9264 -s 488
        6⤵
        Program crash
        
        PID:19088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      4⤵
      PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
      4⤵
      PID:13052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:18516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        6⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        7⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        5⤵
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        5⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
        5⤵
        
        PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58510.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:16876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        5⤵
        
        PID:13812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
      4⤵
      PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exe
      4⤵
      PID:17888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
      4⤵
      PID:15532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
    3⤵
    PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26361.exe
      4⤵
      PID:12500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
    3⤵
    PID:8904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        6⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40629.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        9⤵
        
        PID:18812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        7⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
        7⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        8⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        7⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        8⤵
        
        PID:18468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        7⤵
        
        PID:19240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        6⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        6⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6308.exe
        5⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        6⤵
        
        PID:18840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4381.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        6⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        5⤵
        
        PID:18540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57395.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        5⤵
        
        PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
      4⤵
      PID:15544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36079.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        7⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20821.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        6⤵
        
        PID:19232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        5⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        5⤵
        
        PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61500.exe
        7⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-570.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        5⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57821.exe
      4⤵
      PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        5⤵
        
        PID:19252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59426.exe
      4⤵
      PID:17724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 640
      4⤵
      Program crash
      PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
    3⤵
    PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      4⤵
      PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        5⤵
        
        PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
      4⤵
      PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
    3⤵
    PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
    3⤵
    PID:13848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18778.exe
    3⤵
    PID:18568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        7⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        6⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        5⤵
        
        PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
      4⤵
      PID:17144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        6⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
        5⤵
        
        PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
      4⤵
      PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        5⤵
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
      4⤵
      PID:14284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
    3⤵
    PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        5⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      4⤵
      PID:708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
    3⤵
    PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
      4⤵
      PID:17016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
    3⤵
    PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
    3⤵
    PID:16552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        6⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      4⤵
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2462.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        5⤵
        
        PID:19224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
      4⤵
      PID:11036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
    3⤵
    PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        5⤵
        
        PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23561.exe
      4⤵
      PID:15276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
      4⤵
      PID:14948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
    3⤵
    PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
    3⤵
    PID:14676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23956.exe
    3⤵
    PID:16652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        5⤵
        
        PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
      4⤵
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
    3⤵
    PID:10380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
    3⤵
    PID:16168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
  2⤵
  PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
    3⤵
    PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
    3⤵
    PID:10260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
    3⤵
    PID:3372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
  2⤵
  PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
    3⤵
    PID:9332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
    3⤵
    PID:13228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
    3⤵
    PID:18476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
  2⤵
  PID:9228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
  2⤵
  PID:14532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
  2⤵
  PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 552 -ip 552
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8900 -ip 8900
1⤵
PID:12396

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 9264 -ip 9264
1⤵
PID:18848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 10632 -ip 10632
1⤵
PID:18996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12917.exe

Filesize
468KB

MD5
94ff89c7819de05b7815991cf2a78f29

SHA1
09a81f3afbb3891bd1cc23a348d8813222f4e78c

SHA256
764bd29b337f842e12254ca4154a3799cddb522730bef54d1a2f7ba3b318e8ce

SHA512
4b685cfd50a1d7de63be7491b01e8eebabca2f184a08b24252f22f7e9a83615cf67e59cab5d2c5075ac65f62e40cddb65c2a378de8d8a3932042be0afa44730f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13676.exe

Filesize
468KB

MD5
79c27a15dc2f3f1cf56dc5e4e81ce0bc

SHA1
8687c1a5490055a63000165360ad43ce7362def3

SHA256
e03bbf0244bfe4637ed29f1ad17dc18c4b7bf5ead5e1e1babb0e095002812298

SHA512
5c6ceae37b4a9605cf1d2c3459eefee815cee8e01fe7b60ce42e7ccadcff113e02cf53cadc6f29ec7f72ce0ff3c1c96fc71915641e24ce63ce2f752a749a526a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14282.exe

Filesize
468KB

MD5
e939b6aae02d7e85a6294652651a4b4c

SHA1
5d643db3b39581506e35d792ed8a1659080dd1cb

SHA256
ea912bbd57465557f16a4f9f57f13f41dbe521f4521d570afd4ad4159a588b36

SHA512
8d2507b4c230a7b0bc3793f5e23bdc226e1a6300675beec2044df7016d692ffa2abfbea5df95ed1b5f28926157099b99d1586c1aebe4710f6768d059ea6dd869

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe

Filesize
468KB

MD5
f35a821b2841f848ec78c1da372c329b

SHA1
4f2035fcf74a778b6e65bb501a3bad7962e711d8

SHA256
695510a464ac84a4e8dcfdf0f2fa22f3f461e7b5213d71c74830062c29adbcbe

SHA512
1984accadbca936f171a34553099022538a035ac4d8d914a6f28800097d2abb95c5be6ac60eb135b5858e4f82a0f5c5ec4d4136e60bf008a52b247306f6a374a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe

Filesize
468KB

MD5
f6ea568e486ba19a0d52b18aba0d6e8a

SHA1
e498e2f63f6e05467c4ded19a97d01766c44394c

SHA256
057c3c695b1117eac6da8559fe432b556ca0c6edb7fc90530af5c99561957113

SHA512
01d83d5b1f100a03ef05a565d14618b7e52c091ae5e3b9302e72d932997d3999be3cd54672446f69cccd8018ab483e1bbd60f6d6e7122450be78c38d7349e27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16970.exe

Filesize
468KB

MD5
ce0ca6a4af5fd44fab1d3d5cc5f29036

SHA1
0ac695a261793cb97fdd7ebe8bbf86bd3dfaffe8

SHA256
41f8739d45f11824562b56dac3f8b63a5c088b6c1a5dcf0e65ca0b4db8668ab5

SHA512
9e78d6bc3a703783be7246236554ea46ffaf709ca4404bdefca98caee485dc2891ca74b5b2a34487bcd9bee8da9fe76f89e8bb7ad473a3d82e3a1b1268d91c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe

Filesize
468KB

MD5
1995204602a7663c437925a7c7b7c4b5

SHA1
f4dca177585fff6c914f55a6032a89e1c298ed80

SHA256
283883412bef3eb9f412e8f860830ea596b4b6df87a99e6ff1dc5e07849d5757

SHA512
8912170b0b7b887dbb9fc81f85ca31db168b52b6353da09626da1ab2ccbdfc8b9ebc3d24943e17e3e9fdc2e66c85ce11080a491e712c7afac3712f63a049ba69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe

Filesize
468KB

MD5
aca9316380eadba964dde3bd5a5fb7fd

SHA1
991589eeacb6d79cec670c8c9a0ef21a49eb30d9

SHA256
06ebeab6f81641500ea8a30cafdf40147179bc4e3c2b43f58c6c9c038beee0d2

SHA512
8495fa84a2986fab23f4a5935e8c01c48f5420a41c87ce27084905fd0694e3b32be04e70cad283dd9e98597e0b3a9bbdcc5b28a78776bd1cb0be769edd06ecc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe

Filesize
468KB

MD5
67092edf685257782f2ea0666ad7ebc2

SHA1
6f8de8de3e762dd2c635e0017ac1683245741b0d

SHA256
220657767f8d3660d36df7e29b5df40e0a6a316716144ee22f0b95b7ec2ad5e5

SHA512
3e2eb59b27f4773edcc93edc927d275322134be073e6d65e7e8c5a57ce38d76a3bc8bd01f917cbf9d0fb97ebd84626f671e79720582216e4dc1f58b114ed1253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe

Filesize
468KB

MD5
1066a15526a627445d99c04cb0d67ee6

SHA1
bfef83941bb8b8fdda271e461269934af56c9916

SHA256
c778bd9d70c9b3c4983fe9eb05bfee7489336bb236556f21eda2ea17dc5e2368

SHA512
67a56db03aadc78207bfdfe7bcd9c29bb4281484d487c2a71695c5fbe30d11cefa4595a05ce6fa78f595dfb2204d72acc2ba45cd4d4cc1087013b0ea00af5074

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe

Filesize
468KB

MD5
31b12ab41a41cd6a74aa8263fa5be0c6

SHA1
399e5d7fdf9e266d9a40ddadeb5e7ea50c05203c

SHA256
65347a938b0ed81d6216f7b9ca02b5c0587cf6894bd75df6e960dd859d7207ce

SHA512
44564f36c44039d63434002c2451d06f7f46c34e72578c58f9db2c95593bb3a8258c564b72042626e13c9e5ec04eabc69b146ae63383c0b2de38c4ce98ca2cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe

Filesize
468KB

MD5
855a892e183342631ac183319e7ccd3c

SHA1
2321c30c7ab75087c01353bbb194cd84d8199f2a

SHA256
8ded64d62687c1e7c3c83215d9a88ea8bf83d7bf56a4a3a12ed4b0cae87cbae8

SHA512
5b866a3324da674f2b909552e498adbf5d2c3aad7483f0e63d7887a2afd88d032167a4e25fb60a41b8cc2743317bdacb7cd411de7acf731092b2bdc1b6737a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe

Filesize
468KB

MD5
25be9a561373624a4e6982bbb0c95524

SHA1
56b43bbe96682e8cbf327a386a61440e3d7f9485

SHA256
af81fe962c450023ea3010cf5162a12d1e3b55ee2905afc0bd2e7cb191aa3d5b

SHA512
a4d74a0a298d69c527f4ac018f4397b922bc6a91c32fcba9727baded1eea0bd94a1d4cb18ec16427be1c1be5811c2fb1d652464edd8f6adf20bf047aeff506e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe

Filesize
468KB

MD5
902b49b1b79cde5f142f680110531d24

SHA1
c20b310ace035cc67b4eb9d0957a33f7b94e952b

SHA256
4bb433738ddcb3deddcbd75ea7a03f2a25313233eec95b8fee36a9e12d858608

SHA512
d879e9657b04a48cca6740aab2ea8b571caa99a5549114a1b49589358291d9f07215661827c58596b353986c0b71e3cc82912a18384b3b90b6cd6a87ab2bec24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe

Filesize
468KB

MD5
0ba3831867adc8c9e5b449e4749b0c2d

SHA1
25665cda842b2b3786ba1d8507b59f8a307cb5ac

SHA256
a2dcd0d7170e742bd029b509f828cbfdab9f2edc56541bf9f2b56682f8ceced1

SHA512
26d9366f0ad8147fba9e11ac12b79b6af6522bcdd6b655ca0cef85e0aaec29b0d99663b68034c884aaa92eeba6d10ff08f22d02116fb67608dd29254883ad9b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe

Filesize
468KB

MD5
3f7ef40bef8616eeab17ea34843c263b

SHA1
62f99900fb3a0ab08a53b07eb3dd9e5d3e56a0cb

SHA256
07e0cdc205641c85db05a45eaa8effee6ca7818d3bd280464e2815854dc106b3

SHA512
5b3c2e26fd06b75ebb10f494b2ac74890567c917dc08b1a161ec203a432e0bb579d73e3544e38407089ad0b7e03bb90a89a60451fadb1e7737f20f947624a3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe

Filesize
468KB

MD5
a5b9d749d99d8620f1442a36499ab978

SHA1
9c220607a5b8d3228cb10d8540f1bf2b738d66d3

SHA256
dbc6d83e71a3d12a5113841a4dc87ce1442e9766188cd2dd12515b11c9f70861

SHA512
e0e0fbd75b7f738883275fe3bfcec96b205236a5adf5b002e5f4e34575da01d00a55d77ed0603b84d80e76369ec0e44413c56fd48a0e6b7ac18260fdc4fdcf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe

Filesize
468KB

MD5
0f5dc66d09b0045af885776b7db09c6e

SHA1
0a503c80021c544bd92b7adbe920dc52b741a58b

SHA256
628879097d317332b814272c393bbeb251cbe8f0eac89cddac2aba0f415aa7bb

SHA512
b67e34914031f805cba484b54d4b28c9c51617a53c7937b40d7d895fc53da9d964273412eac038432bdfce6bd4f2aa731bf859d13c8efb89540fae97ae81be79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe

Filesize
468KB

MD5
7b559a1d92b370a5a20886021a66d6c7

SHA1
b8d0478211eb9b99ffae46e930ee00e72393d6d5

SHA256
44a39028dfede2966cec97c7512486405238e4bde5e6cea0a04994e7f4065674

SHA512
bc34e0e3bee6c0b940cdb7fc6f00c01b92c04821c36ae95171853f93ebb2564a829f70145309f80bc3d83dfceaf0ef5b39b27bde56cf870d6fdc186f42f5314b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50751.exe

Filesize
468KB

MD5
7de27c8d86720a4a616203caedd22cd9

SHA1
f0a57dda987c3989305555b0b2415a10f244ce7c

SHA256
7e2086a2b51c192b696d020de6f98dcb9c943fdb4f23b61cf02d2a0111d667af

SHA512
080d6ab19dd3ea24d31ff6d6c36eaa45f73230c4fe121f25e97052862c903be1999c739bd05b13664b488966cfef62479c8c1d5cdd6e8ced55b2ba16718570c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe

Filesize
468KB

MD5
cf893b3bdd9dee90e205c590a7f273b2

SHA1
b16bdba75a1fc78f29d6b1c62bddb750d202658a

SHA256
c688fb9def394b0499f494cd4619f99f97e6560ce91eb282d5df65b6404b8e34

SHA512
a61b6e98ea00aab776f4b86f114b2c4f23db2d22e7c8bfa6422bbfdd0a7476d9f083d24648a8ea4625a383457a01667647abc3dbe64891b1bdfdf3c440e378ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe

Filesize
468KB

MD5
c8546b1826090f2def1fa8830a47732d

SHA1
da2b19e38b94ad2714bb5d960615b4d5840367bd

SHA256
e3868027f614249124bfbc43d4acd9c72b3a0705c3e2d7ee77b746de996b4e09

SHA512
fcff485632c15fbb1e3b7c6cdfbf28009a2a2b2a2e52176062ca956f7ef492db930d890b1b5a61c404a803ffb06f5d946864613d124ed0d2ded755e05520294a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe

Filesize
468KB

MD5
f4872315ef6e783b09d49f47c4be4c1c

SHA1
55336b7c8cda5fee8b04f5a3f0b02f1e6a898d62

SHA256
f543dfa9929000d005f2e4581fc3194d7d40ed9417e29ca2aa66fdc302f4db80

SHA512
f76290996654bf1b57d2e98d54fdc37fc78b121d8df3389f5587fb416824373978258a8343e7b9b5ce2ba5ac6d9dc01180a1e644e162032cebf8587ad527200b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe

Filesize
468KB

MD5
b4c93fadfbd124a8a71d3abd641b05f7

SHA1
2f027ffce674c90d841e021c6acfbb050d8f625c

SHA256
b71f301e9d3ea628da9e1c51b769f6b5a349e52e0b8df0c44871af2b93c6be2c

SHA512
d6b17ee9df6133c2161231be36692b0b997bcc39fa8b52baf6f60ea933c888d846323462c0a2be92c6343e40fcb9000bd23bef017bb56dc6e8bf1764b0075874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe

Filesize
468KB

MD5
11147b04d7ca416008b43520a50253ad

SHA1
a6a96e811a163baedaeb581e179bccec587563da

SHA256
0fcf3837df8392dbbbdc86414c7b35886f16b0a0d3994f04e13e3a594703d3af

SHA512
c992bcb5abcceb12446ea068982aae03b62fecaa11fddef0e24737ccf883119051f16d9b93b6e3558f010b5e64d6a3eb417c2cc29d935927f1c4260c99d34dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe

Filesize
468KB

MD5
fa0a82de3c2203276f6066b5e4831596

SHA1
f0f6ce225e171ceba70bd39318b02e745c2d3ad2

SHA256
669c509c904a14590d78e0e0e5a62eb35c94c85e7433d14ee663ddcb2147c2e1

SHA512
d2c442a6d9b84b6f6c90af641cec593f05d6f9b7c1caefbe7f3fd5a8f7a740a2e5d9ae18136e17fdc75c8dcc37ebc939088d591ee348b7135519eb5242d85073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe

Filesize
468KB

MD5
38321cac862e29a64c7119f146afc17f

SHA1
5209d88f7808985c49159ace86c59c3b97a7d167

SHA256
73d243d18861561b80f1130ef85c24ab84fc796c6f7773e00fb6e4e9600b1766

SHA512
95dc1c602e7ae05d8c3fd3efc4cb8b48218c68bdf4cd408d971b188c4ed45ab05a05104fec4d332862273c80e662005445163d7582080ccf106287c6ecbace68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe

Filesize
468KB

MD5
bab1d021dada88bb5c297c1fda9a5c05

SHA1
7ee382d9ed7dba88c197848e378d62e5213fdc1b

SHA256
34b1015a215b49a6c94422a0b00c337428175b9a661aae8291199ff04c1f6d03

SHA512
dd775d53e867f1b9a208f5b62cb67bfc2c984f1295e886f8ab5d70a9b4f70399d768804ee517c9180b67fc1f1c50f78bf5333edab39858ff2230d5474b8e9623

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63639.exe

Filesize
468KB

MD5
a07e48a13c649db50415b34d1530a8aa

SHA1
e6f7bee781dbff4a94b470002b01117341a7620a

SHA256
85489c80cc21df3ca66095d12977c4007b08cce6c723e526968fa9fcec4ab27c

SHA512
038a442d50e2d5874205f78039aa65c2acd202b27cb15d91c4c00e180e976582e3244f40f0647141c6f116ccd426bf84b2c9ef9a5c0590f4d46c43795ed8df1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe

Filesize
468KB

MD5
238120c619ba9da988afe90298c4db18

SHA1
1f2c48f8cb74619d520bedebf1298c3a73025750

SHA256
9fdf79eef626095472c1122256497994020120d77da99bd727d4702f55485b8d

SHA512
07d334fd0b0b0fed85d5190dd7896457156c8c82807e9c0493f45cb8425f3c84ac80bb99044ad83b92dc58993e107cd9834801f6bdecd548bb67c99c70bf9e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe

Filesize
468KB

MD5
37e9044060001e414386518338454f17

SHA1
4625353d6885f5b784c702043ec666b498899c55

SHA256
bb181034c719ecaec42cff4e3351b0942b10dfad4d4a9c74f0679dd7a281cf1d

SHA512
10b98dfe70ef0dc7e2a3d2dc7a807fb85acae2e63a8077fd0f3ad622a70e16396afcccb6152c80804e5a1c1a6a633ea7e93a36403755bb01bd469647c654ac13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe

Filesize
468KB

MD5
bbaf6d284784f5120f1161354f83e414

SHA1
2639e4ce707de3da18727ea749f224606fa3c5c6

SHA256
e7f572ab8f9b2525202efe3003611bbafdb98fd82b98be46ce5f5a92c196eecc

SHA512
9c17d7a88b9dfa82b66019ae6bbcd0a43d4f7a081eaeb4a8b21ecffab126c1375b9324a023d100feb88341c6e0499a2ee5334e3fcfb8952da9d437337f44df5a

Download Submit
memory/384-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/460-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/524-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/528-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5596-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7624-2449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads